{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "from sklearn.neighbors import KNeighborsClassifier\n",
    "from sklearn.cluster import KMeans\n",
    "from sklearn.preprocessing import MinMaxScaler\n",
    "from sklearn.model_selection import train_test_split\n",
    "from sklearn.metrics import accuracy_score\n",
    "from time import time"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Feature names from the file kddcup.names file to be used as cols heading\n",
    "col_names = [\"duration\",\"protocol_type\",\"service\",\"flag\",\"src_bytes\",\n",
    "    \"dst_bytes\",\"land\",\"wrong_fragment\",\"urgent\",\"hot\",\"num_failed_logins\",\n",
    "    \"logged_in\",\"num_compromised\",\"root_shell\",\"su_attempted\",\"num_root\",\n",
    "    \"num_file_creations\",\"num_shells\",\"num_access_files\",\"num_outbound_cmds\",\n",
    "    \"is_host_login\",\"is_guest_login\",\"count\",\"srv_count\",\"serror_rate\",\n",
    "    \"srv_serror_rate\",\"rerror_rate\",\"srv_rerror_rate\",\"same_srv_rate\",\n",
    "    \"diff_srv_rate\",\"srv_diff_host_rate\",\"dst_host_count\",\"dst_host_srv_count\",\n",
    "    \"dst_host_same_srv_rate\",\"dst_host_diff_srv_rate\",\"dst_host_same_src_port_rate\",\n",
    "    \"dst_host_srv_diff_host_rate\",\"dst_host_serror_rate\",\"dst_host_srv_serror_rate\",\n",
    "    \"dst_host_rerror_rate\",\"dst_host_srv_rerror_rate\",\"label\"]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "kddcup_data_10_percent_corrected = pd.read_csv(\"kddcup.data_10_percent_corrected\", header=None, names = col_names)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>hot</th>\n",
       "      <th>...</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>181</td>\n",
       "      <td>5450</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>9</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.11</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>239</td>\n",
       "      <td>486</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>19</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.05</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>235</td>\n",
       "      <td>1337</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>29</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.03</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>219</td>\n",
       "      <td>1337</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>39</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.03</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>4</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>217</td>\n",
       "      <td>2032</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>49</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.02</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 42 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "   duration protocol_type service flag  src_bytes  dst_bytes  land  \\\n",
       "0         0           tcp    http   SF        181       5450     0   \n",
       "1         0           tcp    http   SF        239        486     0   \n",
       "2         0           tcp    http   SF        235       1337     0   \n",
       "3         0           tcp    http   SF        219       1337     0   \n",
       "4         0           tcp    http   SF        217       2032     0   \n",
       "\n",
       "   wrong_fragment  urgent  hot  ...  dst_host_srv_count  \\\n",
       "0               0       0    0  ...                   9   \n",
       "1               0       0    0  ...                  19   \n",
       "2               0       0    0  ...                  29   \n",
       "3               0       0    0  ...                  39   \n",
       "4               0       0    0  ...                  49   \n",
       "\n",
       "   dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "0                     1.0                     0.0   \n",
       "1                     1.0                     0.0   \n",
       "2                     1.0                     0.0   \n",
       "3                     1.0                     0.0   \n",
       "4                     1.0                     0.0   \n",
       "\n",
       "   dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "0                         0.11                          0.0   \n",
       "1                         0.05                          0.0   \n",
       "2                         0.03                          0.0   \n",
       "3                         0.03                          0.0   \n",
       "4                         0.02                          0.0   \n",
       "\n",
       "   dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "0                   0.0                       0.0                   0.0   \n",
       "1                   0.0                       0.0                   0.0   \n",
       "2                   0.0                       0.0                   0.0   \n",
       "3                   0.0                       0.0                   0.0   \n",
       "4                   0.0                       0.0                   0.0   \n",
       "\n",
       "   dst_host_srv_rerror_rate    label  \n",
       "0                       0.0  normal.  \n",
       "1                       0.0  normal.  \n",
       "2                       0.0  normal.  \n",
       "3                       0.0  normal.  \n",
       "4                       0.0  normal.  \n",
       "\n",
       "[5 rows x 42 columns]"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "kddcup_data_10_percent_corrected.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>protocol_type</th>\n",
       "      <th>service</th>\n",
       "      <th>flag</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>hot</th>\n",
       "      <th>...</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>181</td>\n",
       "      <td>5450</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>9</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.11</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>239</td>\n",
       "      <td>486</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>19</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.05</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>235</td>\n",
       "      <td>1337</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>29</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.03</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>3</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>219</td>\n",
       "      <td>1337</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>39</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.03</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>4</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>217</td>\n",
       "      <td>2032</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>49</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.02</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>494016</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>310</td>\n",
       "      <td>1881</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>255</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.05</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>494017</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>282</td>\n",
       "      <td>2286</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>255</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.17</td>\n",
       "      <td>0.05</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>494018</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>203</td>\n",
       "      <td>1200</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>255</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.06</td>\n",
       "      <td>0.05</td>\n",
       "      <td>0.06</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>494019</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>291</td>\n",
       "      <td>1200</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>255</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.04</td>\n",
       "      <td>0.05</td>\n",
       "      <td>0.04</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>494020</td>\n",
       "      <td>0</td>\n",
       "      <td>tcp</td>\n",
       "      <td>http</td>\n",
       "      <td>SF</td>\n",
       "      <td>219</td>\n",
       "      <td>1234</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>255</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.17</td>\n",
       "      <td>0.05</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>normal.</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>494021 rows × 42 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "        duration protocol_type service flag  src_bytes  dst_bytes  land  \\\n",
       "0              0           tcp    http   SF        181       5450     0   \n",
       "1              0           tcp    http   SF        239        486     0   \n",
       "2              0           tcp    http   SF        235       1337     0   \n",
       "3              0           tcp    http   SF        219       1337     0   \n",
       "4              0           tcp    http   SF        217       2032     0   \n",
       "...          ...           ...     ...  ...        ...        ...   ...   \n",
       "494016         0           tcp    http   SF        310       1881     0   \n",
       "494017         0           tcp    http   SF        282       2286     0   \n",
       "494018         0           tcp    http   SF        203       1200     0   \n",
       "494019         0           tcp    http   SF        291       1200     0   \n",
       "494020         0           tcp    http   SF        219       1234     0   \n",
       "\n",
       "        wrong_fragment  urgent  hot  ...  dst_host_srv_count  \\\n",
       "0                    0       0    0  ...                   9   \n",
       "1                    0       0    0  ...                  19   \n",
       "2                    0       0    0  ...                  29   \n",
       "3                    0       0    0  ...                  39   \n",
       "4                    0       0    0  ...                  49   \n",
       "...                ...     ...  ...  ...                 ...   \n",
       "494016               0       0    0  ...                 255   \n",
       "494017               0       0    0  ...                 255   \n",
       "494018               0       0    0  ...                 255   \n",
       "494019               0       0    0  ...                 255   \n",
       "494020               0       0    0  ...                 255   \n",
       "\n",
       "        dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "0                          1.0                     0.0   \n",
       "1                          1.0                     0.0   \n",
       "2                          1.0                     0.0   \n",
       "3                          1.0                     0.0   \n",
       "4                          1.0                     0.0   \n",
       "...                        ...                     ...   \n",
       "494016                     1.0                     0.0   \n",
       "494017                     1.0                     0.0   \n",
       "494018                     1.0                     0.0   \n",
       "494019                     1.0                     0.0   \n",
       "494020                     1.0                     0.0   \n",
       "\n",
       "        dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "0                              0.11                         0.00   \n",
       "1                              0.05                         0.00   \n",
       "2                              0.03                         0.00   \n",
       "3                              0.03                         0.00   \n",
       "4                              0.02                         0.00   \n",
       "...                             ...                          ...   \n",
       "494016                         0.01                         0.05   \n",
       "494017                         0.17                         0.05   \n",
       "494018                         0.06                         0.05   \n",
       "494019                         0.04                         0.05   \n",
       "494020                         0.17                         0.05   \n",
       "\n",
       "        dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "0                       0.00                      0.00                   0.0   \n",
       "1                       0.00                      0.00                   0.0   \n",
       "2                       0.00                      0.00                   0.0   \n",
       "3                       0.00                      0.00                   0.0   \n",
       "4                       0.00                      0.00                   0.0   \n",
       "...                      ...                       ...                   ...   \n",
       "494016                  0.00                      0.01                   0.0   \n",
       "494017                  0.00                      0.01                   0.0   \n",
       "494018                  0.06                      0.01                   0.0   \n",
       "494019                  0.04                      0.01                   0.0   \n",
       "494020                  0.00                      0.01                   0.0   \n",
       "\n",
       "        dst_host_srv_rerror_rate    label  \n",
       "0                            0.0  normal.  \n",
       "1                            0.0  normal.  \n",
       "2                            0.0  normal.  \n",
       "3                            0.0  normal.  \n",
       "4                            0.0  normal.  \n",
       "...                          ...      ...  \n",
       "494016                       0.0  normal.  \n",
       "494017                       0.0  normal.  \n",
       "494018                       0.0  normal.  \n",
       "494019                       0.0  normal.  \n",
       "494020                       0.0  normal.  \n",
       "\n",
       "[494021 rows x 42 columns]"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "kddcup_data_10_percent_corrected"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "False"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Checking whether any nan entires in dataset exists\n",
    "kddcup_data_10_percent_corrected.isnull().values.any()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "smurf.              280790\n",
       "neptune.            107201\n",
       "normal.              97278\n",
       "back.                 2203\n",
       "satan.                1589\n",
       "ipsweep.              1247\n",
       "portsweep.            1040\n",
       "warezclient.          1020\n",
       "teardrop.              979\n",
       "pod.                   264\n",
       "nmap.                  231\n",
       "guess_passwd.           53\n",
       "buffer_overflow.        30\n",
       "land.                   21\n",
       "warezmaster.            20\n",
       "imap.                   12\n",
       "rootkit.                10\n",
       "loadmodule.              9\n",
       "ftp_write.               8\n",
       "multihop.                7\n",
       "phf.                     4\n",
       "perl.                    3\n",
       "spy.                     2\n",
       "Name: label, dtype: int64"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "kddcup_data_10_percent_corrected['label'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Considering all the numerical features for training. Categorical features excluded as of now.\n",
    "\n",
    "num_features = [\n",
    "    \"duration\",\"src_bytes\",\n",
    "    \"dst_bytes\",\"land\",\"wrong_fragment\",\"urgent\",\"hot\",\"num_failed_logins\",\n",
    "    \"logged_in\",\"num_compromised\",\"root_shell\",\"su_attempted\",\"num_root\",\n",
    "    \"num_file_creations\",\"num_shells\",\"num_access_files\",\"num_outbound_cmds\",\n",
    "    \"is_host_login\",\"is_guest_login\",\"count\",\"srv_count\",\"serror_rate\",\n",
    "    \"srv_serror_rate\",\"rerror_rate\",\"srv_rerror_rate\",\"same_srv_rate\",\n",
    "    \"diff_srv_rate\",\"srv_diff_host_rate\",\"dst_host_count\",\"dst_host_srv_count\",\n",
    "    \"dst_host_same_srv_rate\",\"dst_host_diff_srv_rate\",\"dst_host_same_src_port_rate\",\n",
    "    \"dst_host_srv_diff_host_rate\",\"dst_host_serror_rate\",\"dst_host_srv_serror_rate\",\n",
    "    \"dst_host_rerror_rate\",\"dst_host_srv_rerror_rate\"\n",
    "]\n",
    "features = kddcup_data_10_percent_corrected[num_features].astype(float)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>hot</th>\n",
       "      <th>num_failed_logins</th>\n",
       "      <th>logged_in</th>\n",
       "      <th>num_compromised</th>\n",
       "      <th>...</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <td>count</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>4.940210e+05</td>\n",
       "      <td>4.940210e+05</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>mean</td>\n",
       "      <td>47.979302</td>\n",
       "      <td>3.025610e+03</td>\n",
       "      <td>8.685324e+02</td>\n",
       "      <td>0.000045</td>\n",
       "      <td>0.006433</td>\n",
       "      <td>0.000014</td>\n",
       "      <td>0.034519</td>\n",
       "      <td>0.000152</td>\n",
       "      <td>0.148247</td>\n",
       "      <td>0.010212</td>\n",
       "      <td>...</td>\n",
       "      <td>232.470778</td>\n",
       "      <td>188.665670</td>\n",
       "      <td>0.753780</td>\n",
       "      <td>0.030906</td>\n",
       "      <td>0.601935</td>\n",
       "      <td>0.006684</td>\n",
       "      <td>0.176754</td>\n",
       "      <td>0.176443</td>\n",
       "      <td>0.058118</td>\n",
       "      <td>0.057412</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>std</td>\n",
       "      <td>707.746472</td>\n",
       "      <td>9.882181e+05</td>\n",
       "      <td>3.304000e+04</td>\n",
       "      <td>0.006673</td>\n",
       "      <td>0.134805</td>\n",
       "      <td>0.005510</td>\n",
       "      <td>0.782103</td>\n",
       "      <td>0.015520</td>\n",
       "      <td>0.355345</td>\n",
       "      <td>1.798326</td>\n",
       "      <td>...</td>\n",
       "      <td>64.745380</td>\n",
       "      <td>106.040437</td>\n",
       "      <td>0.410781</td>\n",
       "      <td>0.109259</td>\n",
       "      <td>0.481309</td>\n",
       "      <td>0.042133</td>\n",
       "      <td>0.380593</td>\n",
       "      <td>0.380919</td>\n",
       "      <td>0.230590</td>\n",
       "      <td>0.230140</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>min</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>25%</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>4.500000e+01</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>46.000000</td>\n",
       "      <td>0.410000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>50%</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>5.200000e+02</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>75%</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.032000e+03</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.040000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>max</td>\n",
       "      <td>58329.000000</td>\n",
       "      <td>6.933756e+08</td>\n",
       "      <td>5.155468e+06</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>3.000000</td>\n",
       "      <td>3.000000</td>\n",
       "      <td>30.000000</td>\n",
       "      <td>5.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>884.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>8 rows × 38 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "            duration     src_bytes     dst_bytes           land  \\\n",
       "count  494021.000000  4.940210e+05  4.940210e+05  494021.000000   \n",
       "mean       47.979302  3.025610e+03  8.685324e+02       0.000045   \n",
       "std       707.746472  9.882181e+05  3.304000e+04       0.006673   \n",
       "min         0.000000  0.000000e+00  0.000000e+00       0.000000   \n",
       "25%         0.000000  4.500000e+01  0.000000e+00       0.000000   \n",
       "50%         0.000000  5.200000e+02  0.000000e+00       0.000000   \n",
       "75%         0.000000  1.032000e+03  0.000000e+00       0.000000   \n",
       "max     58329.000000  6.933756e+08  5.155468e+06       1.000000   \n",
       "\n",
       "       wrong_fragment         urgent            hot  num_failed_logins  \\\n",
       "count   494021.000000  494021.000000  494021.000000      494021.000000   \n",
       "mean         0.006433       0.000014       0.034519           0.000152   \n",
       "std          0.134805       0.005510       0.782103           0.015520   \n",
       "min          0.000000       0.000000       0.000000           0.000000   \n",
       "25%          0.000000       0.000000       0.000000           0.000000   \n",
       "50%          0.000000       0.000000       0.000000           0.000000   \n",
       "75%          0.000000       0.000000       0.000000           0.000000   \n",
       "max          3.000000       3.000000      30.000000           5.000000   \n",
       "\n",
       "           logged_in  num_compromised  ...  dst_host_count  \\\n",
       "count  494021.000000    494021.000000  ...   494021.000000   \n",
       "mean        0.148247         0.010212  ...      232.470778   \n",
       "std         0.355345         1.798326  ...       64.745380   \n",
       "min         0.000000         0.000000  ...        0.000000   \n",
       "25%         0.000000         0.000000  ...      255.000000   \n",
       "50%         0.000000         0.000000  ...      255.000000   \n",
       "75%         0.000000         0.000000  ...      255.000000   \n",
       "max         1.000000       884.000000  ...      255.000000   \n",
       "\n",
       "       dst_host_srv_count  dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "count       494021.000000           494021.000000           494021.000000   \n",
       "mean           188.665670                0.753780                0.030906   \n",
       "std            106.040437                0.410781                0.109259   \n",
       "min              0.000000                0.000000                0.000000   \n",
       "25%             46.000000                0.410000                0.000000   \n",
       "50%            255.000000                1.000000                0.000000   \n",
       "75%            255.000000                1.000000                0.040000   \n",
       "max            255.000000                1.000000                1.000000   \n",
       "\n",
       "       dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "count                494021.000000                494021.000000   \n",
       "mean                      0.601935                     0.006684   \n",
       "std                       0.481309                     0.042133   \n",
       "min                       0.000000                     0.000000   \n",
       "25%                       0.000000                     0.000000   \n",
       "50%                       1.000000                     0.000000   \n",
       "75%                       1.000000                     0.000000   \n",
       "max                       1.000000                     1.000000   \n",
       "\n",
       "       dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "count         494021.000000             494021.000000         494021.000000   \n",
       "mean               0.176754                  0.176443              0.058118   \n",
       "std                0.380593                  0.380919              0.230590   \n",
       "min                0.000000                  0.000000              0.000000   \n",
       "25%                0.000000                  0.000000              0.000000   \n",
       "50%                0.000000                  0.000000              0.000000   \n",
       "75%                0.000000                  0.000000              0.000000   \n",
       "max                1.000000                  1.000000              1.000000   \n",
       "\n",
       "       dst_host_srv_rerror_rate  \n",
       "count             494021.000000  \n",
       "mean                   0.057412  \n",
       "std                    0.230140  \n",
       "min                    0.000000  \n",
       "25%                    0.000000  \n",
       "50%                    0.000000  \n",
       "75%                    0.000000  \n",
       "max                    1.000000  \n",
       "\n",
       "[8 rows x 38 columns]"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "features.describe()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "attack.    396743\n",
       "normal.     97278\n",
       "Name: label, dtype: int64"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# reduce the outputs to normal and attack.\n",
    "\n",
    "labels = kddcup_data_10_percent_corrected['label'].copy()\n",
    "labels[labels!='normal.'] = 'attack.'\n",
    "labels.value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>hot</th>\n",
       "      <th>num_failed_logins</th>\n",
       "      <th>logged_in</th>\n",
       "      <th>num_compromised</th>\n",
       "      <th>...</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>181.0</td>\n",
       "      <td>5450.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>9.0</td>\n",
       "      <td>9.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.11</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>1</td>\n",
       "      <td>0.0</td>\n",
       "      <td>239.0</td>\n",
       "      <td>486.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>19.0</td>\n",
       "      <td>19.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.05</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>2</td>\n",
       "      <td>0.0</td>\n",
       "      <td>235.0</td>\n",
       "      <td>1337.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>29.0</td>\n",
       "      <td>29.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.03</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>3</td>\n",
       "      <td>0.0</td>\n",
       "      <td>219.0</td>\n",
       "      <td>1337.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>39.0</td>\n",
       "      <td>39.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.03</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>4</td>\n",
       "      <td>0.0</td>\n",
       "      <td>217.0</td>\n",
       "      <td>2032.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>49.0</td>\n",
       "      <td>49.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.02</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 38 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "   duration  src_bytes  dst_bytes  land  wrong_fragment  urgent  hot  \\\n",
       "0       0.0      181.0     5450.0   0.0             0.0     0.0  0.0   \n",
       "1       0.0      239.0      486.0   0.0             0.0     0.0  0.0   \n",
       "2       0.0      235.0     1337.0   0.0             0.0     0.0  0.0   \n",
       "3       0.0      219.0     1337.0   0.0             0.0     0.0  0.0   \n",
       "4       0.0      217.0     2032.0   0.0             0.0     0.0  0.0   \n",
       "\n",
       "   num_failed_logins  logged_in  num_compromised  ...  dst_host_count  \\\n",
       "0                0.0        1.0              0.0  ...             9.0   \n",
       "1                0.0        1.0              0.0  ...            19.0   \n",
       "2                0.0        1.0              0.0  ...            29.0   \n",
       "3                0.0        1.0              0.0  ...            39.0   \n",
       "4                0.0        1.0              0.0  ...            49.0   \n",
       "\n",
       "   dst_host_srv_count  dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "0                 9.0                     1.0                     0.0   \n",
       "1                19.0                     1.0                     0.0   \n",
       "2                29.0                     1.0                     0.0   \n",
       "3                39.0                     1.0                     0.0   \n",
       "4                49.0                     1.0                     0.0   \n",
       "\n",
       "   dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "0                         0.11                          0.0   \n",
       "1                         0.05                          0.0   \n",
       "2                         0.03                          0.0   \n",
       "3                         0.03                          0.0   \n",
       "4                         0.02                          0.0   \n",
       "\n",
       "   dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "0                   0.0                       0.0                   0.0   \n",
       "1                   0.0                       0.0                   0.0   \n",
       "2                   0.0                       0.0                   0.0   \n",
       "3                   0.0                       0.0                   0.0   \n",
       "4                   0.0                       0.0                   0.0   \n",
       "\n",
       "   dst_host_srv_rerror_rate  \n",
       "0                       0.0  \n",
       "1                       0.0  \n",
       "2                       0.0  \n",
       "3                       0.0  \n",
       "4                       0.0  \n",
       "\n",
       "[5 rows x 38 columns]"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "features.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Feature scaling\n",
    "\n",
    "features[num_features] = MinMaxScaler().fit_transform(features[num_features])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>hot</th>\n",
       "      <th>num_failed_logins</th>\n",
       "      <th>logged_in</th>\n",
       "      <th>num_compromised</th>\n",
       "      <th>...</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <td>count</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>4.940210e+05</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "      <td>494021.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>mean</td>\n",
       "      <td>0.000823</td>\n",
       "      <td>4.363595e-06</td>\n",
       "      <td>0.000168</td>\n",
       "      <td>0.000045</td>\n",
       "      <td>0.002144</td>\n",
       "      <td>0.000005</td>\n",
       "      <td>0.001151</td>\n",
       "      <td>0.000030</td>\n",
       "      <td>0.148247</td>\n",
       "      <td>0.000012</td>\n",
       "      <td>...</td>\n",
       "      <td>0.911650</td>\n",
       "      <td>0.739865</td>\n",
       "      <td>0.753780</td>\n",
       "      <td>0.030906</td>\n",
       "      <td>0.601935</td>\n",
       "      <td>0.006684</td>\n",
       "      <td>0.176754</td>\n",
       "      <td>0.176443</td>\n",
       "      <td>0.058118</td>\n",
       "      <td>0.057412</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>std</td>\n",
       "      <td>0.012134</td>\n",
       "      <td>1.425228e-03</td>\n",
       "      <td>0.006409</td>\n",
       "      <td>0.006673</td>\n",
       "      <td>0.044935</td>\n",
       "      <td>0.001837</td>\n",
       "      <td>0.026070</td>\n",
       "      <td>0.003104</td>\n",
       "      <td>0.355345</td>\n",
       "      <td>0.002034</td>\n",
       "      <td>...</td>\n",
       "      <td>0.253903</td>\n",
       "      <td>0.415845</td>\n",
       "      <td>0.410781</td>\n",
       "      <td>0.109259</td>\n",
       "      <td>0.481309</td>\n",
       "      <td>0.042133</td>\n",
       "      <td>0.380593</td>\n",
       "      <td>0.380919</td>\n",
       "      <td>0.230590</td>\n",
       "      <td>0.230140</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>min</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>25%</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>6.489989e-08</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.180392</td>\n",
       "      <td>0.410000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>50%</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>7.499542e-07</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>75%</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.488371e-06</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.040000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>max</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000e+00</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>...</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>8 rows × 38 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "            duration     src_bytes      dst_bytes           land  \\\n",
       "count  494021.000000  4.940210e+05  494021.000000  494021.000000   \n",
       "mean        0.000823  4.363595e-06       0.000168       0.000045   \n",
       "std         0.012134  1.425228e-03       0.006409       0.006673   \n",
       "min         0.000000  0.000000e+00       0.000000       0.000000   \n",
       "25%         0.000000  6.489989e-08       0.000000       0.000000   \n",
       "50%         0.000000  7.499542e-07       0.000000       0.000000   \n",
       "75%         0.000000  1.488371e-06       0.000000       0.000000   \n",
       "max         1.000000  1.000000e+00       1.000000       1.000000   \n",
       "\n",
       "       wrong_fragment         urgent            hot  num_failed_logins  \\\n",
       "count   494021.000000  494021.000000  494021.000000      494021.000000   \n",
       "mean         0.002144       0.000005       0.001151           0.000030   \n",
       "std          0.044935       0.001837       0.026070           0.003104   \n",
       "min          0.000000       0.000000       0.000000           0.000000   \n",
       "25%          0.000000       0.000000       0.000000           0.000000   \n",
       "50%          0.000000       0.000000       0.000000           0.000000   \n",
       "75%          0.000000       0.000000       0.000000           0.000000   \n",
       "max          1.000000       1.000000       1.000000           1.000000   \n",
       "\n",
       "           logged_in  num_compromised  ...  dst_host_count  \\\n",
       "count  494021.000000    494021.000000  ...   494021.000000   \n",
       "mean        0.148247         0.000012  ...        0.911650   \n",
       "std         0.355345         0.002034  ...        0.253903   \n",
       "min         0.000000         0.000000  ...        0.000000   \n",
       "25%         0.000000         0.000000  ...        1.000000   \n",
       "50%         0.000000         0.000000  ...        1.000000   \n",
       "75%         0.000000         0.000000  ...        1.000000   \n",
       "max         1.000000         1.000000  ...        1.000000   \n",
       "\n",
       "       dst_host_srv_count  dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "count       494021.000000           494021.000000           494021.000000   \n",
       "mean             0.739865                0.753780                0.030906   \n",
       "std              0.415845                0.410781                0.109259   \n",
       "min              0.000000                0.000000                0.000000   \n",
       "25%              0.180392                0.410000                0.000000   \n",
       "50%              1.000000                1.000000                0.000000   \n",
       "75%              1.000000                1.000000                0.040000   \n",
       "max              1.000000                1.000000                1.000000   \n",
       "\n",
       "       dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "count                494021.000000                494021.000000   \n",
       "mean                      0.601935                     0.006684   \n",
       "std                       0.481309                     0.042133   \n",
       "min                       0.000000                     0.000000   \n",
       "25%                       0.000000                     0.000000   \n",
       "50%                       1.000000                     0.000000   \n",
       "75%                       1.000000                     0.000000   \n",
       "max                       1.000000                     1.000000   \n",
       "\n",
       "       dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "count         494021.000000             494021.000000         494021.000000   \n",
       "mean               0.176754                  0.176443              0.058118   \n",
       "std                0.380593                  0.380919              0.230590   \n",
       "min                0.000000                  0.000000              0.000000   \n",
       "25%                0.000000                  0.000000              0.000000   \n",
       "50%                0.000000                  0.000000              0.000000   \n",
       "75%                0.000000                  0.000000              0.000000   \n",
       "max                1.000000                  1.000000              1.000000   \n",
       "\n",
       "       dst_host_srv_rerror_rate  \n",
       "count             494021.000000  \n",
       "mean                   0.057412  \n",
       "std                    0.230140  \n",
       "min                    0.000000  \n",
       "25%                    0.000000  \n",
       "50%                    0.000000  \n",
       "75%                    0.000000  \n",
       "max                    1.000000  \n",
       "\n",
       "[8 rows x 38 columns]"
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "features.describe()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [],
   "source": [
    "clf = KNeighborsClassifier(n_neighbors = 5, algorithm = 'ball_tree', leaf_size=500)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Classifier trained in 579.65 seconds\n"
     ]
    }
   ],
   "source": [
    "t0 = time()\n",
    "clf.fit(features,labels)\n",
    "tt = time()-t0\n",
    "print(\"Classifier trained in {} seconds\".format(round(tt,3)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "smurf.              164091\n",
       "normal.              60593\n",
       "neptune.             58001\n",
       "snmpgetattack.        7741\n",
       "mailbomb.             5000\n",
       "guess_passwd.         4367\n",
       "snmpguess.            2406\n",
       "satan.                1633\n",
       "warezmaster.          1602\n",
       "back.                 1098\n",
       "mscan.                1053\n",
       "apache2.               794\n",
       "processtable.          759\n",
       "saint.                 736\n",
       "portsweep.             354\n",
       "ipsweep.               306\n",
       "httptunnel.            158\n",
       "pod.                    87\n",
       "nmap.                   84\n",
       "buffer_overflow.        22\n",
       "multihop.               18\n",
       "named.                  17\n",
       "sendmail.               17\n",
       "ps.                     16\n",
       "xterm.                  13\n",
       "rootkit.                13\n",
       "teardrop.               12\n",
       "xlock.                   9\n",
       "land.                    9\n",
       "xsnoop.                  4\n",
       "ftp_write.               3\n",
       "phf.                     2\n",
       "worm.                    2\n",
       "loadmodule.              2\n",
       "sqlattack.               2\n",
       "perl.                    2\n",
       "udpstorm.                2\n",
       "imap.                    1\n",
       "Name: label, dtype: int64"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "kdd_data_corrected = pd.read_csv(\"corrected\", header=None, names = col_names)\n",
    "kdd_data_corrected['label'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/snap/jupyter/6/lib/python3.7/site-packages/ipykernel_launcher.py:1: SettingWithCopyWarning: \n",
      "A value is trying to be set on a copy of a slice from a DataFrame\n",
      "\n",
      "See the caveats in the documentation: http://pandas.pydata.org/pandas-docs/stable/user_guide/indexing.html#returning-a-view-versus-a-copy\n",
      "  \"\"\"Entry point for launching an IPython kernel.\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "attack.    250436\n",
       "normal.     60593\n",
       "Name: label, dtype: int64"
      ]
     },
     "execution_count": 25,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "kdd_data_corrected['label'][kdd_data_corrected['label']!='normal.'] = 'attack.'\n",
    "kdd_data_corrected['label'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [],
   "source": [
    "kdd_data_corrected[num_features] = kdd_data_corrected[num_features].astype(float)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [],
   "source": [
    "kdd_data_corrected[num_features] = MinMaxScaler().fit_transform(kdd_data_corrected[num_features])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>duration</th>\n",
       "      <th>src_bytes</th>\n",
       "      <th>dst_bytes</th>\n",
       "      <th>land</th>\n",
       "      <th>wrong_fragment</th>\n",
       "      <th>urgent</th>\n",
       "      <th>hot</th>\n",
       "      <th>num_failed_logins</th>\n",
       "      <th>logged_in</th>\n",
       "      <th>num_compromised</th>\n",
       "      <th>...</th>\n",
       "      <th>dst_host_count</th>\n",
       "      <th>dst_host_srv_count</th>\n",
       "      <th>dst_host_same_srv_rate</th>\n",
       "      <th>dst_host_diff_srv_rate</th>\n",
       "      <th>dst_host_same_src_port_rate</th>\n",
       "      <th>dst_host_srv_diff_host_rate</th>\n",
       "      <th>dst_host_serror_rate</th>\n",
       "      <th>dst_host_srv_serror_rate</th>\n",
       "      <th>dst_host_rerror_rate</th>\n",
       "      <th>dst_host_srv_rerror_rate</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <td>0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000002</td>\n",
       "      <td>0.000028</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.996078</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>1</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000002</td>\n",
       "      <td>0.000028</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.996078</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>2</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000002</td>\n",
       "      <td>0.000028</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.996078</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>3</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000002</td>\n",
       "      <td>0.000028</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.996078</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>4</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000002</td>\n",
       "      <td>0.000028</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.996078</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>311024</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000002</td>\n",
       "      <td>0.000028</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>311025</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000002</td>\n",
       "      <td>0.000028</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>311026</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000002</td>\n",
       "      <td>0.000028</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>311027</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000002</td>\n",
       "      <td>0.000028</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>311028</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.000002</td>\n",
       "      <td>0.000028</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.0</td>\n",
       "      <td>0.00</td>\n",
       "      <td>0.01</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "      <td>0.0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>311029 rows × 38 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "        duration  src_bytes  dst_bytes  land  wrong_fragment  urgent  hot  \\\n",
       "0            0.0   0.000002   0.000028   0.0             0.0     0.0  0.0   \n",
       "1            0.0   0.000002   0.000028   0.0             0.0     0.0  0.0   \n",
       "2            0.0   0.000002   0.000028   0.0             0.0     0.0  0.0   \n",
       "3            0.0   0.000002   0.000028   0.0             0.0     0.0  0.0   \n",
       "4            0.0   0.000002   0.000028   0.0             0.0     0.0  0.0   \n",
       "...          ...        ...        ...   ...             ...     ...  ...   \n",
       "311024       0.0   0.000002   0.000028   0.0             0.0     0.0  0.0   \n",
       "311025       0.0   0.000002   0.000028   0.0             0.0     0.0  0.0   \n",
       "311026       0.0   0.000002   0.000028   0.0             0.0     0.0  0.0   \n",
       "311027       0.0   0.000002   0.000028   0.0             0.0     0.0  0.0   \n",
       "311028       0.0   0.000002   0.000028   0.0             0.0     0.0  0.0   \n",
       "\n",
       "        num_failed_logins  logged_in  num_compromised  ...  dst_host_count  \\\n",
       "0                     0.0        0.0              0.0  ...             1.0   \n",
       "1                     0.0        0.0              0.0  ...             1.0   \n",
       "2                     0.0        0.0              0.0  ...             1.0   \n",
       "3                     0.0        0.0              0.0  ...             1.0   \n",
       "4                     0.0        0.0              0.0  ...             1.0   \n",
       "...                   ...        ...              ...  ...             ...   \n",
       "311024                0.0        0.0              0.0  ...             1.0   \n",
       "311025                0.0        0.0              0.0  ...             1.0   \n",
       "311026                0.0        0.0              0.0  ...             1.0   \n",
       "311027                0.0        0.0              0.0  ...             1.0   \n",
       "311028                0.0        0.0              0.0  ...             1.0   \n",
       "\n",
       "        dst_host_srv_count  dst_host_same_srv_rate  dst_host_diff_srv_rate  \\\n",
       "0                 0.996078                     1.0                    0.01   \n",
       "1                 0.996078                     1.0                    0.01   \n",
       "2                 0.996078                     1.0                    0.01   \n",
       "3                 0.996078                     1.0                    0.01   \n",
       "4                 0.996078                     1.0                    0.01   \n",
       "...                    ...                     ...                     ...   \n",
       "311024            1.000000                     1.0                    0.00   \n",
       "311025            1.000000                     1.0                    0.00   \n",
       "311026            1.000000                     1.0                    0.00   \n",
       "311027            1.000000                     1.0                    0.00   \n",
       "311028            1.000000                     1.0                    0.00   \n",
       "\n",
       "        dst_host_same_src_port_rate  dst_host_srv_diff_host_rate  \\\n",
       "0                              0.00                          0.0   \n",
       "1                              0.00                          0.0   \n",
       "2                              0.00                          0.0   \n",
       "3                              0.00                          0.0   \n",
       "4                              0.01                          0.0   \n",
       "...                             ...                          ...   \n",
       "311024                         0.01                          0.0   \n",
       "311025                         0.01                          0.0   \n",
       "311026                         0.01                          0.0   \n",
       "311027                         0.01                          0.0   \n",
       "311028                         0.01                          0.0   \n",
       "\n",
       "        dst_host_serror_rate  dst_host_srv_serror_rate  dst_host_rerror_rate  \\\n",
       "0                        0.0                       0.0                   0.0   \n",
       "1                        0.0                       0.0                   0.0   \n",
       "2                        0.0                       0.0                   0.0   \n",
       "3                        0.0                       0.0                   0.0   \n",
       "4                        0.0                       0.0                   0.0   \n",
       "...                      ...                       ...                   ...   \n",
       "311024                   0.0                       0.0                   0.0   \n",
       "311025                   0.0                       0.0                   0.0   \n",
       "311026                   0.0                       0.0                   0.0   \n",
       "311027                   0.0                       0.0                   0.0   \n",
       "311028                   0.0                       0.0                   0.0   \n",
       "\n",
       "        dst_host_srv_rerror_rate  \n",
       "0                            0.0  \n",
       "1                            0.0  \n",
       "2                            0.0  \n",
       "3                            0.0  \n",
       "4                            0.0  \n",
       "...                          ...  \n",
       "311024                       0.0  \n",
       "311025                       0.0  \n",
       "311026                       0.0  \n",
       "311027                       0.0  \n",
       "311028                       0.0  \n",
       "\n",
       "[311029 rows x 38 columns]"
      ]
     },
     "execution_count": 29,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "kdd_data_corrected[num_features]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "metadata": {},
   "outputs": [],
   "source": [
    "features_train, features_test, labels_train, labels_test = train_test_split(\n",
    "    kdd_data_corrected[num_features], \n",
    "    kdd_data_corrected['label'], \n",
    "    test_size=0.1, \n",
    "    random_state=42)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Predicted in 211.511 seconds\n"
     ]
    }
   ],
   "source": [
    "t0 = time()\n",
    "pred = clf.predict(features_test)\n",
    "tt = time() - t0\n",
    "print(\"Predicted in {} seconds\".format(round(tt,3)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "R squared is 0.92.\n"
     ]
    }
   ],
   "source": [
    "acc = accuracy_score(pred, labels_test)\n",
    "print(\"R squared is {}.\".format(round(acc,4)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Clustered in 27.015 seconds\n"
     ]
    }
   ],
   "source": [
    "k = 30\n",
    "km = KMeans(n_clusters = k)\n",
    "\n",
    "\n",
    "t0 = time()\n",
    "km.fit(features)\n",
    "tt = time()-t0\n",
    "print(\"Clustered in {} seconds\".format(round(tt,3)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "1     280648\n",
       "2      48556\n",
       "20     38320\n",
       "11     23620\n",
       "12     18964\n",
       "0      11602\n",
       "26     10471\n",
       "3      10083\n",
       "4       9120\n",
       "5       4272\n",
       "18      3592\n",
       "7       3526\n",
       "16      3215\n",
       "24      3209\n",
       "6       3120\n",
       "15      2919\n",
       "27      2586\n",
       "13      1944\n",
       "23      1919\n",
       "17      1877\n",
       "28      1720\n",
       "29      1348\n",
       "14      1218\n",
       "25      1187\n",
       "8       1138\n",
       "9       1016\n",
       "19      1002\n",
       "21       970\n",
       "22       680\n",
       "10       179\n",
       "dtype: int64"
      ]
     },
     "execution_count": 41,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "pd.Series(km.labels_).value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {},
   "outputs": [],
   "source": [
    "labels = kddcup_data_10_percent_corrected['label']\n",
    "label_names = list(map(\n",
    "    lambda x: pd.Series([labels[i] for i in range(len(km.labels_)) if km.labels_[i]==x]), \n",
    "    range(k)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Cluster 0 labels:\n",
      "normal.    11471\n",
      "smurf.       130\n",
      "nmap.          1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 1 labels:\n",
      "smurf.     280615\n",
      "normal.        33\n",
      "dtype: int64\n",
      "\n",
      "Cluster 2 labels:\n",
      "neptune.      48552\n",
      "portsweep.        4\n",
      "dtype: int64\n",
      "\n",
      "Cluster 3 labels:\n",
      "neptune.      10059\n",
      "portsweep.       24\n",
      "dtype: int64\n",
      "\n",
      "Cluster 4 labels:\n",
      "normal.    9120\n",
      "dtype: int64\n",
      "\n",
      "Cluster 5 labels:\n",
      "normal.       4238\n",
      "satan.          25\n",
      "portsweep.       9\n",
      "dtype: int64\n",
      "\n",
      "Cluster 6 labels:\n",
      "normal.    3035\n",
      "back.        84\n",
      "satan.        1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 7 labels:\n",
      "normal.         3511\n",
      "back.             14\n",
      "warezclient.       1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 8 labels:\n",
      "ipsweep.     813\n",
      "normal.      139\n",
      "nmap.         99\n",
      "pod.          72\n",
      "land.         14\n",
      "multihop.      1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 9 labels:\n",
      "normal.     1012\n",
      "ipsweep.       3\n",
      "back.          1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 10 labels:\n",
      "satan.        175\n",
      "portsweep.      3\n",
      "land.           1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 11 labels:\n",
      "normal.    22358\n",
      "back.       1258\n",
      "phf.           3\n",
      "satan.         1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 12 labels:\n",
      "normal.    18964\n",
      "dtype: int64\n",
      "\n",
      "Cluster 13 labels:\n",
      "normal.       1875\n",
      "pod.            40\n",
      "ipsweep.         7\n",
      "satan.           6\n",
      "smurf.           5\n",
      "nmap.            3\n",
      "neptune.         3\n",
      "imap.            2\n",
      "teardrop.        1\n",
      "portsweep.       1\n",
      "land.            1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 14 labels:\n",
      "satan.        1216\n",
      "portsweep.       2\n",
      "dtype: int64\n",
      "\n",
      "Cluster 15 labels:\n",
      "normal.    2919\n",
      "dtype: int64\n",
      "\n",
      "Cluster 16 labels:\n",
      "normal.          3157\n",
      "guess_passwd.      49\n",
      "back.               6\n",
      "portsweep.          2\n",
      "neptune.            1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 17 labels:\n",
      "normal.             1189\n",
      "warezclient.         657\n",
      "buffer_overflow.      16\n",
      "loadmodule.            5\n",
      "ftp_write.             4\n",
      "back.                  3\n",
      "multihop.              2\n",
      "rootkit.               1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 18 labels:\n",
      "normal.         3519\n",
      "warezclient.      56\n",
      "rootkit.           4\n",
      "satan.             3\n",
      "perl.              3\n",
      "ipsweep.           2\n",
      "ftp_write.         2\n",
      "loadmodule.        1\n",
      "spy.               1\n",
      "imap.              1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 19 labels:\n",
      "portsweep.    917\n",
      "ipsweep.       83\n",
      "normal.         2\n",
      "dtype: int64\n",
      "\n",
      "Cluster 20 labels:\n",
      "neptune.         38188\n",
      "nmap.              103\n",
      "portsweep.          19\n",
      "normal.              6\n",
      "land.                2\n",
      "guess_passwd.        1\n",
      "imap.                1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 21 labels:\n",
      "teardrop.    970\n",
      "dtype: int64\n",
      "\n",
      "Cluster 22 labels:\n",
      "normal.         370\n",
      "warezclient.    306\n",
      "multihop.         2\n",
      "warezmaster.      2\n",
      "dtype: int64\n",
      "\n",
      "Cluster 23 labels:\n",
      "normal.      1787\n",
      "pod.           60\n",
      "smurf.         37\n",
      "satan.         22\n",
      "teardrop.       7\n",
      "rootkit.        3\n",
      "nmap.           2\n",
      "spy.            1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 24 labels:\n",
      "normal.             2751\n",
      "back.                441\n",
      "buffer_overflow.      14\n",
      "loadmodule.            2\n",
      "guess_passwd.          1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 25 labels:\n",
      "normal.    1187\n",
      "dtype: int64\n",
      "\n",
      "Cluster 26 labels:\n",
      "neptune.      10397\n",
      "portsweep.       57\n",
      "satan.           13\n",
      "normal.           4\n",
      "dtype: int64\n",
      "\n",
      "Cluster 27 labels:\n",
      "normal.    2189\n",
      "back.       396\n",
      "phf.          1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 28 labels:\n",
      "normal.          1205\n",
      "ipsweep.          339\n",
      "pod.               92\n",
      "nmap.              23\n",
      "satan.             18\n",
      "warezmaster.       18\n",
      "imap.               8\n",
      "land.               3\n",
      "smurf.              3\n",
      "guess_passwd.       2\n",
      "ftp_write.          2\n",
      "multihop.           2\n",
      "rootkit.            2\n",
      "portsweep.          1\n",
      "neptune.            1\n",
      "loadmodule.         1\n",
      "dtype: int64\n",
      "\n",
      "Cluster 29 labels:\n",
      "normal.       1237\n",
      "satan.         109\n",
      "teardrop.        1\n",
      "portsweep.       1\n",
      "dtype: int64\n",
      "\n"
     ]
    }
   ],
   "source": [
    "for i in range(k):\n",
    "    print(\"Cluster {} labels:\".format(i))\n",
    "    print(label_names[i].value_counts())\n",
    "    print()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Assigned clusters in 0.121 seconds\n"
     ]
    }
   ],
   "source": [
    "t0 = time()\n",
    "pred = km.predict(kdd_data_corrected[num_features])\n",
    "tt = time() - t0\n",
    "print(\"Assigned clusters in {} seconds\".format(round(tt,3)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.3"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}
